CVE-2026-68981 Overview
CVE-2026-68981 affects Apache NiFi versions 1.5.0 through 2.10.0. The framework accepts gzip-encoded HTTP requests to the REST API through a Jersey encoding filter. NiFi enforces its configurable maximum request size against the compressed payload, not the decompressed output. A remote attacker can send a small gzip-compressed request that expands into a large in-memory payload, exhausting available memory on the NiFi node. This weakness is classified as [CWE-409] Improper Handling of Highly Compressed Data (Data Amplification). Apache resolved the issue in NiFi 2.11.0 by relocating response compression to the Jetty Server and disabling decompression of gzip-encoded HTTP requests.
Critical Impact
Unauthenticated attackers can trigger memory exhaustion on Apache NiFi nodes by sending crafted gzip-encoded HTTP requests, resulting in denial of service.
Affected Products
- Apache NiFi 1.5.0 through 1.x latest
- Apache NiFi 2.0.0 through 2.10.0
- Deployments exposing the REST API to untrusted clients
Discovery Timeline
- 2026-08-03 - CVE-2026-68981 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-68981
Vulnerability Analysis
Apache NiFi exposes an HTTP REST API for management and dataflow operations. The framework uses a Jersey encoding filter to accept Content-Encoding: gzip requests. When such a request arrives, NiFi evaluates the configured maximum request size limit against the compressed byte stream before decompression occurs.
Because gzip achieves high compression ratios on repetitive input, a small compressed request can decompress into a payload orders of magnitude larger. The Jersey filter streams the decompressed output into memory during request processing. An attacker who understands this behavior can craft a compact request that inflates into a large buffer, driving the Java Virtual Machine toward memory exhaustion.
Repeated requests amplify the impact and can degrade or crash the NiFi node, disrupting dataflow operations across the cluster.
Root Cause
The root cause is size validation applied to the wrong data. The maximum request size check operates on the compressed input, so decompression proceeds without an upper bound on the resulting memory allocation. This is a classic data amplification flaw tracked under [CWE-409].
Attack Vector
The attack requires network access to the NiFi REST API endpoint. No authentication or user interaction is required to submit a gzip-encoded request. An attacker sends an HTTP request with Content-Encoding: gzip and a payload compressed from highly repetitive data. NiFi accepts the request, begins decompression, and allocates memory proportional to the expanded content rather than the transmitted bytes.
See the Apache Thread Discussion and Openwall OSS Security Update for the vendor's technical description.
Detection Methods for CVE-2026-68981
Indicators of Compromise
- HTTP requests to the NiFi REST API carrying the Content-Encoding: gzip header from unexpected client sources.
- Sudden JVM heap growth or OutOfMemoryError events in NiFi application logs correlated with inbound REST API traffic.
- Repeated small requests to the NiFi API followed by node unresponsiveness or cluster failover events.
Detection Strategies
- Monitor NiFi access logs for Content-Encoding: gzip on REST API paths and flag requests whose declared or observed decompressed size exceeds operational baselines.
- Alert on JVM garbage collection pressure, heap saturation, and process restarts on NiFi hosts.
- Correlate network telemetry showing low-byte inbound requests with high memory consumption on the receiving NiFi node.
Monitoring Recommendations
- Enable verbose logging on the Jersey filter and reverse proxy fronting NiFi to capture request encoding and byte counts.
- Track NiFi cluster health metrics, including heap usage, thread counts, and REST API latency, in a centralized monitoring system.
- Baseline normal REST API request volume and size to detect anomalous compressed traffic patterns.
How to Mitigate CVE-2026-68981
Immediate Actions Required
- Upgrade Apache NiFi to version 2.11.0 or later, which relocates response compression to Jetty Server and disables decompression of gzip-encoded HTTP requests.
- Restrict network access to the NiFi REST API using firewall rules, reverse proxies, or service mesh policies until the upgrade is applied.
- Enforce authentication and TLS on all REST API endpoints to limit exposure to untrusted clients.
Patch Information
Apache released the fix in NiFi 2.11.0. The patch moves response compression to the Jetty Server layer and disables server-side decompression of gzip-encoded requests, eliminating the amplification path. Details are documented in the Apache Thread Discussion.
Workarounds
- Configure an upstream reverse proxy such as NGINX or HAProxy to reject requests with Content-Encoding: gzip targeting the NiFi REST API.
- Enforce strict per-connection request size and rate limits at the proxy layer to constrain memory allocation on the NiFi node.
- Isolate NiFi management interfaces on a dedicated network segment accessible only to trusted administrative hosts.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
